skills.rest
jd-opensource
jd-opensourceOFFICIAL
Explore all skills by this author →
WebsiteGitHub

pentest-supply-chain

Audit dependencies, CI/CD pipelines, and build artifacts for supply chain risks.

299|56|Updated Jan 13, 2026
Search Tags:#ci-cd#supply-chain-security#typosquatting#dependency-confusion#sbom#artifact-integrity
One-click install
npx skills add https://github.com/jd-opensource/JoySafeter --skill pentest-supply-chain
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentest-supply-chain
Source: https://github.com/jd-opensource/JoySafeter/tree/main/skills/pentest-supply-chain
Command: npx skills add https://github.com/jd-opensource/JoySafeter --skill pentest-supply-chain

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Supply chain attacks threaten the integrity of software by tampering with dependencies, CI/CD pipelines, and build artifacts. This Skill provides a structured approach to assess and mitigate these risks across the codebase.

Core Features & Use Cases

  • Dependency Audit: identify vulnerable dependencies and unmaintained packages across ecosystems.
  • Dependency Confusion testing: check for namespace squatting and misconfigured registries.
  • CI/CD Pipeline Security: review workflows for secrets exposure, unpinned actions, and runner escapes.
  • Build Artifact Integrity: verify signatures and tamper-resistance of produced artifacts.
  • Lockfile Integrity: detect manipulated lockfiles and ensure manifest-to-lockfile consistency.
  • Install Script Abuse & Typosquatting: identify install hooks that may exfiltrate data or execute malicious code.
  • SBOM Generation: generate software bill of materials and map risk to dependencies.
  • Use Case: For large multi-language repos, run cross-language supply chain security audits and consolidate findings.

Quick Start

Run a full supply-chain security assessment on your repository using the described toolset to identify dependencies, CI/CD weaknesses, and artifact integrity issues.

Frequently Asked Questions about pentest-supply-chain

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit dependencies and CI/CD pipelines for software supply chain attacks?▼

Software supply chain security audits identify and mitigate risks across dependencies, CI/CD pipelines, and build artifacts. You can review workflows for unpinned actions, validate lockfiles, and detect typosquatting using tools like Snyk, npm audit, and Trivy.

What is dependency confusion and how do I test for namespace squatting?▼

Dependency confusion occurs when attackers exploit misconfigured registries by namespace squatting. You can test for this supply chain vulnerability by checking your multi-language repository configurations to ensure internal packages are not shadowed by public ones.

Does this supply chain security approach work with npm, PyPI, and Go modules?▼

Yes, this supply chain security assessment is applicable to npm, PyPI, Go modules, and container workflows. It orchestrates tools like pip-audit, Trivy, and lockfile-lint to consolidate cross-language dependency findings in enterprise projects.

How do I generate an SBOM and map dependency risks to MITRE ATT&CK techniques?▼

You can generate a Software Bill of Materials (SBOM) to inventory components and map identified dependency risks to MITRE ATT&CK techniques. This process tracks vulnerable packages and unmaintained libraries across your entire codebase.

Can I detect malicious install scripts and verify build artifact integrity?▼

Artifact integrity checks verify signatures and tamper-resistance of produced build artifacts. You can simultaneously detect install script abuse by identifying install hooks that may exfiltrate data or execute malicious code during package installation.

What is the best way to secure unpinned GitHub Actions and prevent runner escapes?▼

Securing CI/CD pipelines involves reviewing workflows for unpinned actions and runner escapes. Using tools like actionlint allows you to validate workflow syntax and identify secrets exposure before merging code into enterprise repositories.

Related Skills

Explore More Software Engineering Skills→
Veloxia-agencyVeloxia-agency

ci-cd-pipeline-builder

Detect repository stack signals and generate CI/CD pipeline templates for GitHub Actions or GitLab CI.

Community
Intermediate
farmountainfarmountain
1

Vulnerability Scanner Agent

Scan code, dependencies, containers, and infrastructure for vulnerabilities across the SDLC.

Community
Advanced
kivo360kivo360
1

moai-domain-security

Mitigate security vulnerabilities in CI/CD pipelines using OWASP Top 10 and SAST/DAST workflows.

Community
Advanced
KuaaMUKuaaMU
4

code-review-security

Scan Python FastAPI and React code for OWASP Top 10 vulnerabilities.

Community
Advanced